@ggui-ai/mcp-server 0.9.0 → 0.10.0

package/dist/code-routes.js

@@ -28,12 +28,22 @@
  * store sees the parameter.
  */
 import { CODE_HASH_REGEX } from "@ggui-ai/mcp-server-core";
+import { mountCodeModuleVariantRoute, } from "./code-module-variant.js";
 /**
- * Mount `GET /code/:hash.js` + `GET /contract/:hash.js` onto the
- * express app. Returns nothing — the routes self-register.
+ * Mount `GET /code/:hash.js` + `GET /contract/:hash.js` (+ the
+ * module-variant route when configured) onto the express app. Returns
+ * nothing — the routes self-register.
  */
 export function mountCodeRoutes(opts) {
     const { app, codeStore, logger } = opts;
+    if (opts.moduleVariant !== undefined) {
+        mountCodeModuleVariantRoute({
+            app,
+            codeStore,
+            variant: opts.moduleVariant,
+            logger,
+        });
+    }
     const mountContentAddressableRoute = (mountPath, label) => {
         app.get(mountPath, async (req, res) => {
             res.setHeader("Access-Control-Allow-Origin", "*");

package/dist/control-service.d.ts

@@ -88,6 +88,18 @@ export declare function filterHandlersByAudience(set: ReadonlyArray<AnyHandler>,
  * mutations. Confirm-gating it would break the card's inline render on
  * the first call, because the confirmation preview does not carry the
  * card's discriminant.
+ *
+ * `ggui_ops_save_library_blueprint` is the one MUTATING entry, by owner
+ * ruling (ggui#525, 2026-08-16). The argument that it is safe on the
+ * first call: the save is idempotent under the name-collapse rule (same
+ * slug ⇒ one row, a repeat is a no-op), it writes only to the CALLER's
+ * own library (no cross-tenant or account-wide effect), and its caller
+ * is the console helper agent auto-saving after a render — the
+ * "confirm" it performed was an agent self-confirm with no human in
+ * the loop, which bought no safety and cost one extra tool round trip
+ * on every helper render. A future entry that lacks any of those three
+ * properties (idempotent, own-scope, no human to protect) does NOT
+ * inherit this ruling — it argues its own.
  */
 export declare const SINGLE_CALL_OPS: ReadonlySet<string>;
 /**
@@ -110,8 +122,12 @@ export declare function stripAudience<I extends ZodRawShape, O extends ZodRawSha
  * populated: every deployment tier proves identity differently
  * (single-user builder, per-app key, per-user key, OIDC), and only the
  * source distinguishes "the adapter authenticated this request" from
- * "the transport let it through". Transports map
- * {@link AuthRequiredError} to 401 so clients can prompt for sign-in.
+ * "the transport let it through". This gate is defense-in-depth
+ * behind the transport's anonymous-ops 401 challenge (ggui#505, see
+ * `mcp-endpoint-routes.ts`): anonymous callers normally never reach
+ * dispatch on an ops tool; a throw HERE surfaces as an in-band
+ * `isError` tool result, which is the contract for callers that
+ * authenticated but lack what the handler needs.
  */
 export declare function withAuthGate<I extends ZodRawShape, O extends ZodRawShape, D>(h: SharedHandler<I, O, D>): SharedHandler<I, O, D>;
 /**
@@ -155,6 +171,16 @@ export interface BuildControlServiceArgs {
  * design-time tools, and the per-handler auth gate is what keeps the
  * ops half closed.
  */
-export declare function buildControlService(args: BuildControlServiceArgs): McpService;
+export declare function buildControlService(args: BuildControlServiceArgs): ControlService;
+/**
+ * {@link McpService} plus the control plane's ops-tool name set — the
+ * membership the transport-level OAuth challenge reads. A separate
+ * field (rather than audience tags on the handlers) because service
+ * handlers deliberately carry no audience tag (see
+ * {@link stripAudience}).
+ */
+export interface ControlService extends McpService {
+    readonly opsToolNames: ReadonlySet<string>;
+}
 export {};
 //# sourceMappingURL=control-service.d.ts.map

package/dist/control-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAK,KAAK,WAAW,EAAmB,MAAM,KAAK,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAa9C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,EAC3E,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,EAC1E,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAYxB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,EAC7E,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CA+BzC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,UAAU,CAmB7E"}
+{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAK,KAAK,WAAW,EAAmB,MAAM,KAAK,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAgB9C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,EAC3E,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,EAC1E,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAYxB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,EAC7E,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CA+BzC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAwBjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C"}

package/dist/control-service.js

@@ -89,11 +89,24 @@ export function filterHandlersByAudience(set, allowed) {
  * mutations. Confirm-gating it would break the card's inline render on
  * the first call, because the confirmation preview does not carry the
  * card's discriminant.
+ *
+ * `ggui_ops_save_library_blueprint` is the one MUTATING entry, by owner
+ * ruling (ggui#525, 2026-08-16). The argument that it is safe on the
+ * first call: the save is idempotent under the name-collapse rule (same
+ * slug ⇒ one row, a repeat is a no-op), it writes only to the CALLER's
+ * own library (no cross-tenant or account-wide effect), and its caller
+ * is the console helper agent auto-saving after a render — the
+ * "confirm" it performed was an agent self-confirm with no human in
+ * the loop, which bought no safety and cost one extra tool round trip
+ * on every helper render. A future entry that lacks any of those three
+ * properties (idempotent, own-scope, no human to protect) does NOT
+ * inherit this ruling — it argues its own.
  */
 export const SINGLE_CALL_OPS = new Set([
     "ggui_ops_get_credit_balance",
     "ggui_ops_get_my_blueprint_source",
     "ggui_ops_get_org_balance",
+    "ggui_ops_get_render_source",
     "ggui_ops_list_apps",
     "ggui_ops_list_blueprints",
     "ggui_ops_list_connector_keys",
@@ -102,6 +115,8 @@ export const SINGLE_CALL_OPS = new Set([
     "ggui_ops_list_my_blueprints",
     "ggui_ops_list_orgs",
     "ggui_ops_list_provider_keys",
+    "ggui_ops_list_recent_renders",
+    "ggui_ops_save_library_blueprint",
     "ggui_ops_setup_byok",
 ]);
 /**
@@ -127,8 +142,12 @@ export function stripAudience(h) {
  * populated: every deployment tier proves identity differently
  * (single-user builder, per-app key, per-user key, OIDC), and only the
  * source distinguishes "the adapter authenticated this request" from
- * "the transport let it through". Transports map
- * {@link AuthRequiredError} to 401 so clients can prompt for sign-in.
+ * "the transport let it through". This gate is defense-in-depth
+ * behind the transport's anonymous-ops 401 challenge (ggui#505, see
+ * `mcp-endpoint-routes.ts`): anonymous callers normally never reach
+ * dispatch on an ops tool; a throw HERE surfaces as an in-band
+ * `isError` tool result, which is the contract for callers that
+ * authenticated but lack what the handler needs.
  */
 export function withAuthGate(h) {
     return {
@@ -216,5 +235,10 @@ export function buildControlService(args) {
         path: CONTROL_PATH,
         handlers,
         anonymous: true,
+        // Captured BEFORE stripAudience erases the tags — the transport's
+        // anonymous-ops 401 challenge (ggui#505) needs the ops-name set,
+        // and the stripped handlers can no longer answer "which of you are
+        // ops". This service is the single authority on that membership.
+        opsToolNames: new Set(opsTools.map((h) => h.name)),
     };
 }

package/dist/health-routes.d.ts

@@ -5,9 +5,10 @@
  *                          loop can run a handler, regardless of
  *                          readiness).
  *   GET /ggui/health     — readiness probe; runs the operator-supplied
- *                          readiness checks and reports per-check
- *                          results, live-channel counts, and the
- *                          thread-transport durability claim.
+ *                          readiness checks, advisory checks, and
+ *                          reports per-check results, live-channel
+ *                          counts, and the thread-transport durability
+ *                          claim.
  *   GET /ggui/auth-check — authenticated liveness. 204 when the bearer
  *                          resolves via the configured AuthAdapter,
  *                          401 otherwise (with `WWW-Authenticate` when
@@ -44,6 +45,21 @@ interface MountOptions {
         readonly name: string;
         readonly check: () => boolean | Promise<boolean>;
     }>;
+    /**
+     * Reported but non-gating checks — surfaced under `body.advisoryChecks`
+     * in the `/ggui/health` response with the SAME per-check boolean
+     * shape as `readinessChecks`, but a failing advisory check never
+     * flips `status` or the HTTP status code. Use this for a dependency
+     * whose health is worth reporting for diagnostics but that MUST NOT
+     * affect readiness on its own — e.g. a best-effort side channel
+     * every consumer already degrades gracefully around when the
+     * dependency is unavailable. Same 1s per-check timeout as
+     * `readinessChecks`; a timeout or thrown check reports `false`.
+     */
+    readonly advisoryChecks?: ReadonlyArray<{
+        readonly name: string;
+        readonly check: () => boolean | Promise<boolean>;
+    }>;
     /**
      * Late-bound live-channel reference. The channel is constructed
      * AFTER these routes mount (declaration-order in the composer), so

package/dist/health-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAU1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC;IACrE,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAuI1D"}
+{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAW1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC;IACrE,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAmJ1D"}

package/dist/health-routes.js

@@ -5,9 +5,10 @@
  *                          loop can run a handler, regardless of
  *                          readiness).
  *   GET /ggui/health     — readiness probe; runs the operator-supplied
- *                          readiness checks and reports per-check
- *                          results, live-channel counts, and the
- *                          thread-transport durability claim.
+ *                          readiness checks, advisory checks, and
+ *                          reports per-check results, live-channel
+ *                          counts, and the thread-transport durability
+ *                          claim.
  *   GET /ggui/auth-check — authenticated liveness. 204 when the bearer
  *                          resolves via the configured AuthAdapter,
  *                          401 otherwise (with `WWW-Authenticate` when
@@ -31,8 +32,9 @@ import { resolveIdentity, UnauthenticatedError } from "./auth.js";
 import { buildWwwAuthenticate, resolveIssuerUrl } from "./oauth.js";
 /**
  * 1s per-check timeout — a hung dependency must not block the K8s
- * liveness probe, which itself runs on a short period. A timeout is
- * treated as a failed check; the dependency is degraded either way.
+ * readiness probe (/ggui/health), which itself runs on a short period.
+ * A timeout is treated as a failed check; the dependency is degraded
+ * either way.
  */
 const READINESS_CHECK_TIMEOUT_MS = 1_000;
 /**
@@ -40,29 +42,29 @@ const READINESS_CHECK_TIMEOUT_MS = 1_000;
  * express app. Returns nothing — the routes self-register.
  */
 export function mountHealthRoutes(opts) {
-    const { app, info, toolCount, readinessChecks, getChannel, threads, auth, oauthEnabled, logger, corsOrigins, } = opts;
-    async function runReadinessChecks() {
-        if (readinessChecks.length === 0) {
-            return { allReady: true, results: {} };
+    const { app, info, toolCount, readinessChecks, advisoryChecks, getChannel, threads, auth, oauthEnabled, logger, corsOrigins, } = opts;
+    async function runChecks(checks) {
+        if (checks.length === 0) {
+            return { allOk: true, results: {} };
         }
         const results = {};
-        let allReady = true;
-        await Promise.all(readinessChecks.map(async ({ name, check }) => {
+        let allOk = true;
+        await Promise.all(checks.map(async ({ name, check }) => {
             try {
-                const ready = await Promise.race([
+                const ok = await Promise.race([
                     Promise.resolve().then(() => check()),
                     new Promise((resolve) => setTimeout(() => resolve(false), READINESS_CHECK_TIMEOUT_MS)),
                 ]);
-                results[name] = ready;
-                if (!ready)
-                    allReady = false;
+                results[name] = ok;
+                if (!ok)
+                    allOk = false;
             }
             catch {
                 results[name] = false;
-                allReady = false;
+                allOk = false;
             }
         }));
-        return { allReady, results };
+        return { allOk, results };
     }
     // No body needed for the kubelet's HTTP check (status code is the
     // signal), but a tiny JSON keeps the endpoint debuggable from a
@@ -73,7 +75,10 @@ export function mountHealthRoutes(opts) {
     });
     app.get("/ggui/health", (_req, res) => {
         void (async () => {
-            const { allReady, results } = await runReadinessChecks();
+            const [{ allOk: allReady, results }, { results: advisoryResults },] = await Promise.all([
+                runChecks(readinessChecks),
+                runChecks(advisoryChecks ?? []),
+            ]);
             const body = {
                 status: allReady ? "ok" : "degraded",
                 server: info.name,
@@ -111,6 +116,9 @@ export function mountHealthRoutes(opts) {
             if (Object.keys(results).length > 0) {
                 body.checks = results;
             }
+            if (Object.keys(advisoryResults).length > 0) {
+                body.advisoryChecks = advisoryResults;
+            }
             res.status(allReady ? 200 : 503).json(body);
         })();
     });

package/dist/index.d.ts

@@ -33,7 +33,9 @@ export { buildOpsBundleHandlers, createGguiServer, defaultHandlers } from './ser
 export type { CreateGguiServerOptions, ErrorMapperResult, GguiServer, OpsBundleDeps, } from './server.js';
 export { buildControlService, CONTROL_PATH, filterHandlersByAudience, SINGLE_CALL_OPS, } from './control-service.js';
 export type { AudienceTag, BuildControlServiceArgs } from './control-service.js';
-export { computeRuntimeBundleHash, insertRuntimeBundleHash, resolveHashedRuntimeBundleUrl, } from './runtime-bundle-hash.js';
+export { computeRuntimeBundleHash, insertRuntimeBundleHash, resolveHashedRuntimeBundleUrl, resolveRuntimeBundleHash, } from './runtime-bundle-hash.js';
+export { createCodeModuleUrlMinter, composeCodeModuleUrl, } from './code-module-variant.js';
+export type { MintCodeModuleUrl } from './code-module-variant.js';
 export { FileSystemCodeStore } from './code-store-fs.js';
 export type { FileSystemCodeStoreOptions } from './code-store-fs.js';
 export type { McpServerMount } from './mcp-mounts.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlF,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxF,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAMjF,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAKrE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMtD,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EACV,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAKtE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAK3E,OAAO,EACL,kCAAkC,EAClC,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAM5E,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,YAAY,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAKzF,OAAO,EACL,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,QAAQ,IAAI,2BAA2B,GACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAIhG,YAAY,EACV,oBAAoB,EACpB,OAAO,EACP,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAQrF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AASxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAOlE,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAU/E,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAOhE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAU9D,YAAY,EACV,WAAW,EACX,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EACV,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlF,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxF,YAAY,EACV,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,EACV,aAAa,GACd,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAMjF,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EACL,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAKrE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMtD,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,GACf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EACV,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAKtE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAK3E,OAAO,EACL,kCAAkC,EAClC,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAM5E,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,YAAY,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAKzF,OAAO,EACL,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,QAAQ,IAAI,2BAA2B,GACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAIhG,YAAY,EACV,oBAAoB,EACpB,OAAO,EACP,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAQrF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AASxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAOlE,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAU/E,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAOhE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAU9D,YAAY,EACV,WAAW,EACX,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EACV,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -42,7 +42,13 @@ export { buildControlService, CONTROL_PATH, filterHandlersByAudience, SINGLE_CAL
 // that compose their own render handler (replacing the factory's
 // default set) and therefore mint an absolute `runtimeUrl` directly —
 // one derivation, no drift against the route the factory mounts.
-export { computeRuntimeBundleHash, insertRuntimeBundleHash, resolveHashedRuntimeBundleUrl, } from './runtime-bundle-hash.js';
+export { computeRuntimeBundleHash, insertRuntimeBundleHash, resolveHashedRuntimeBundleUrl, resolveRuntimeBundleHash, } from './runtime-bundle-hash.js';
+// Strict-CSP module-variant delivery (ggui#522 slice 2). The minter is
+// exported for the same composed-handler deployments: a pod that binds
+// `codeStore`/`codeBaseUrl` on its own render tool builds the minter
+// from `resolveRuntimeBundleHash()` so its `codeModuleUrl`s name the
+// exact variant family the co-resident factory routes serve.
+export { createCodeModuleUrlMinter, composeCodeModuleUrl, } from './code-module-variant.js';
 // Content-addressable code delivery (2026-05-03). FileSystemCodeStore
 // is the OSS dev default; in-memory variant ships in
 // `@ggui-ai/mcp-server-core/in-memory` for tests + ephemeral runs.

package/dist/mcp-apps-outbound.d.ts

@@ -32,12 +32,12 @@
  *   same `@ggui-ai/mcp-server` instance that mints the bootstrap.
  */
 import type { BlueprintIndex, GguiSessionStore, VectorStore } from "@ggui-ai/mcp-server-core";
-import { type BlueprintDurabilityDeps } from "@ggui-ai/mcp-server-handlers/renders";
+import { type BlueprintDurabilityDeps, type SliceThemeDeps } from "@ggui-ai/mcp-server-handlers/renders";
 import { type McpAppAiGguiRenderMeta } from "@ggui-ai/protocol/integrations/mcp-apps";
 import { type McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { HandlerContext } from "@ggui-ai/mcp-server-handlers";
 import type { Logger } from "./logger.js";
-export declare const GGUI_RENDER_SHELL_HTML = "<!doctype html>\n<html lang=\"en\" style=\"height:100%;background-color:var(--ggui-color-surface, #1e293b)\"><head><meta charset=\"utf-8\"><title>ggui render</title></head>\n<body style=\"margin:0;height:100%;min-height:480px;background-color:var(--ggui-color-surface, #1e293b)\"><div id=\"ggui-root\" data-ggui-shell=\"thin\" style=\"height:100%;min-height:480px\"></div>\n<script>\n(function(){'use strict';\n// MCP Apps shell. Speaks the canonical postMessage protocol from\n// @modelcontextprotocol/ext-apps:\n//   1. iframe -> host: ui/initialize\n//   2. iframe -> host: ui/notifications/initialized\n//   3. host -> iframe: ui/notifications/tool-result (per CallToolResult)\n// On tool-result, read the slice envelope from _meta (spec-canonical\n// CallToolResult _meta at the top level), set window.__GGUI_META__ to\n// the envelope, fetch runtime as blob, inject as script.\n// Runtime auto-mounts inline. No nested iframe (claudemcpcontent.com\n// CSP frame-src forbids cross-origin frames). State machine matches\n// buildSelfContainedShell so the same runtime mounts both paths.\n//\n// R5 (2026-05-26): the historic /r/<shortCode> HTTP fallback was\n// removed along with the bearer-by-obscurity model -- hosts that strip\n// _meta no longer have a recovery path here. Spec-canonical hosts\n// deliver _meta inline and are unaffected.\n//\n// Phase B (2026-05-27): the historic two-slice envelope\n// (`ai.ggui/session` + `ai.ggui/stack-item`) collapsed to ONE flat\n// `ai.ggui/render` slice. runtimeUrl now lives directly on the\n// render slice; sessionId is the canonical identity.\nvar rpcId=1,pending={};\nvar rootEl=document.getElementById('ggui-root');\nrootEl.style.cssText='display:flex;flex-direction:column;height:100%;min-height:300px;margin:0';\nvar mounted=false;\nvar lastEnvelope=null;\n// Text color pairs with the shell surface: themed var when the runtime\n// injected theme CSS, else the light-on-dark fallback matching the\n// shell's static #1e293b pre-theme surface. The old hardcoded #666 was\n// illegible on that dark fallback (#481).\nvar SHELL_FG='var(--ggui-color-onSurface,#e2e8f0)';\nfunction setOverlay(text){\n  if(mounted)return;\n  rootEl.innerHTML='<div style=\"font:13px system-ui,sans-serif;padding:24px;color:'+SHELL_FG+';opacity:.55\">'+text+'</div>';\n}\nfunction escText(s){\n  return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/\"/g,'&quot;');\n}\n// Terminal failure card (#481): plain-language summary, diagnostic\n// reachable but collapsed, Retry only when a retry can actually work.\n// Same visual vocabulary as the runtime's React error boundary so the\n// two error surfaces read as one system.\nfunction showFailure(summary,detail,retry){\n  if(mounted)return;\n  rootEl.innerHTML=''+\n    '<div style=\"display:flex;flex-direction:column;align-items:center;justify-content:center;gap:10px;padding:32px 24px;min-height:160px;font-family:system-ui,sans-serif;color:'+SHELL_FG+';text-align:center\">'+\n      '<div style=\"font-size:14px;font-weight:600\">'+escText(summary)+'</div>'+\n      '<div style=\"font-size:12px;opacity:.65;max-width:320px;line-height:1.45\">The interface could not start. The conversation is unaffected \u2014 you can also just ask for the view again.</div>'+\n      (retry?'<button id=\"ggui-shell-retry\" style=\"margin-top:2px;padding:7px 18px;border-radius:8px;border:1px solid currentColor;background:transparent;color:inherit;opacity:.75;font:500 13px system-ui,sans-serif;cursor:pointer\">Retry</button>':'')+\n      '<details style=\"margin-top:6px;max-width:340px;width:100%;text-align:left;opacity:.75\">'+\n        '<summary style=\"cursor:pointer;font-size:12px\">Details</summary>'+\n        '<pre style=\"margin:6px 0 0;font:11px/1.5 ui-monospace,Menlo,monospace;white-space:pre-wrap;word-break:break-word\">'+escText(detail)+'</pre>'+\n      '</details>'+\n    '</div>';\n  if(retry){\n    var b=document.getElementById('ggui-shell-retry');\n    if(b)b.onclick=retry;\n  }\n}\nfunction postNotification(method,params){\n  try{window.parent.postMessage({jsonrpc:'2.0',method:method,params:params||{}},'*');}catch(e){}\n}\nfunction postRpc(method,params){\n  return new Promise(function(res,rej){\n    var id=rpcId++;pending[id]={res:res,rej:rej};\n    try{window.parent.postMessage({jsonrpc:'2.0',id:id,method:method,params:params||{}},'*');}\n    catch(e){delete pending[id];rej(e);}\n  });\n}\nfunction postBootstrapFailed(reason,message){\n  // Surface every shell-layer bootstrap-failure path as a typed\n  // RendererBootFailedMessage envelope so hosts pinning the C9\n  // error pane (McpAppIframe onError, IframeErrorPane) see the\n  // failure instead of staring at the inert overlay until the test\n  // times out. Reason codes match BootstrapFailureReason.\n  try{window.parent.postMessage({type:'ggui:bootstrap-failed',reason:reason,message:message},'*');}catch(e){}\n}\nasync function mountFromMeta(envelope){\n  if(mounted)return;\n  // Slice envelope shape (Phase B): { \"ai.ggui/render\": { sessionId,\n  // appId, runtimeUrl, ... } }. runtimeUrl on the render slice is\n  // the only load-bearing field at the shell layer \u2014 it tells us\n  // which iframe-runtime bundle to fetch. Everything else is\n  // optional; the runtime decides at boot time based on the meta\n  // it reads from window.__GGUI_META__.\n  var renderSlice=envelope&&envelope['ai.ggui/render'];\n  var runtimeUrl=renderSlice&&renderSlice.runtimeUrl;\n  if(!envelope||typeof runtimeUrl!=='string'){\n    // No retry: without a valid envelope there is nothing to re-run.\n    showFailure('This view could not start','MALFORMED_BOOTSTRAP: bootstrap payload malformed (no ai.ggui/render slice with a runtimeUrl).',null);\n    postBootstrapFailed('MALFORMED_BOOTSTRAP','Bootstrap payload malformed.');\n    return;\n  }\n  lastEnvelope=envelope;\n  setOverlay('Loading UI\u2026');\n  window.__GGUI_META__=envelope;\n  // Load the runtime bundle via a direct cross-origin script tag\n  // (governed by CSP script-src) instead of fetch + Blob (governed by\n  // CSP connect-src). claude.ai's claudemcpcontent.com iframe CSP\n  // forbids cross-origin connect-src so fetch throws TypeError\n  // 'Failed to fetch', but allows cross-origin script-src when the\n  // bundle responds with the right CORS headers (the iframe-runtime\n  // mount sets them). The self-contained shell already uses this\n  // pattern; legacy postMessage shell now matches it.\n  try{\n    var s=document.createElement('script');\n    s.type='module';\n    // crossorigin=anonymous opts into CORS-mode error reporting.\n    // Without it, cross-origin script tags get a sanitized\n    // \"script error\" with no details, masking the real cause\n    // (CSP block, CORS reject, module-evaluation throw). With it,\n    // the error event surfaces the actual message in the iframe\n    // console -- the bundle ships ACAO=* so credentialed mode is\n    // unnecessary.\n    s.crossOrigin='anonymous';\n    s.src=runtimeUrl;\n    s.onload=function(){mounted=true;};\n    s.onerror=function(e){\n      var msg='Runtime bundle failed to load: '+(e&&e.message||'script error');\n      showFailure('This view could not load','BUNDLE_FETCH_FAILED: '+msg,function(){mountFromMeta(lastEnvelope);});\n      postBootstrapFailed('BUNDLE_FETCH_FAILED',msg);\n    };\n    rootEl.innerHTML='';\n    document.body.appendChild(s);\n  }catch(e){\n    var msg='Runtime bundle failed to load: '+(e&&e.message||e);\n    showFailure('This view could not load','BUNDLE_FETCH_FAILED: '+msg,function(){mountFromMeta(lastEnvelope);});\n    postBootstrapFailed('BUNDLE_FETCH_FAILED',msg);\n  }\n}\nfunction readMetaFromCallToolResult(params){\n  // MCP Apps spec (specification/2026-01-26/apps.mdx:1145-1155):\n  //   ui/notifications/tool-result\n  //   params: CallToolResult  // Standard MCP type\n  // So params IS the CallToolResult and _meta lives at the top\n  // level. Spec-compliant hosts (Claude Desktop, claude.ai\n  // Connector, Claude Code) deliver slice-envelope material here.\n  // Single slice-envelope key (Phase B: ai.ggui/render). Only the\n  // render slice's runtimeUrl is load-bearing at the shell layer;\n  // the runtime reads everything else off window.__GGUI_META__\n  // after we set it.\n  if(!params||typeof params!=='object')return null;\n  var meta=params._meta;\n  if(!meta||typeof meta!=='object')return null;\n  var renderSlice=meta['ai.ggui/render'];\n  if(!renderSlice||typeof renderSlice!=='object')return null;\n  if(typeof renderSlice.runtimeUrl!=='string')return null;\n  return meta;\n}\nwindow.addEventListener('message',function(ev){\n  var m=ev&&ev.data;\n  if(!m||m.jsonrpc!=='2.0')return;\n  if(m.id!=null&&pending[m.id]){\n    var p=pending[m.id];delete pending[m.id];\n    if(m.error)p.rej(m.error);else p.res(m.result);\n    return;\n  }\n  if(m.method==='ui/notifications/tool-result'){\n    // Spec-compliant hosts: m.params IS the CallToolResult; _meta is\n    // at the top level.\n    var specMeta=readMetaFromCallToolResult(m.params);\n    if(specMeta){mountFromMeta(specMeta);return;}\n    // R5 (2026-05-26) -- the /r/<shortCode> HTTP fallback was removed\n    // along with the bearer-by-obscurity model. Hosts that strip\n    // _meta on the tool-result wire have no fallback path here;\n    // spec-canonical hosts deliver meta inline and land in the branch\n    // above.\n  }\n});\n// Named so the failure card's Retry can re-run the whole handshake \u2014\n// a host that missed or rejected the first ui/initialize may answer a\n// second (observed with hosts that attach their listener late).\nfunction startInit(){\n  setOverlay('Initializing\u2026');\n  var initTimer=setTimeout(function(){\n    showFailure('This view did not hear back from its host','INIT_TIMEOUT: no response to ui/initialize within 3s.',startInit);\n  },3000);\n  postRpc('ui/initialize',{\n    appCapabilities:{},\n    appInfo:{name:'ggui-render',version:'1.0.0'},\n    protocolVersion:'2026-01-26'\n  }).then(function(){\n    clearTimeout(initTimer);\n    postNotification('ui/notifications/initialized',{});\n    // Wait for the host to send ui/notifications/tool-result carrying\n    // the slice envelope in _meta \u2014 the spec-canonical delivery channel.\n    // The ui/initialize result itself carries no slice meta (the\n    // McpUiInitializeResult schema defines no such field).\n    setOverlay('Waiting for tool result\u2026');\n  }).catch(function(e){\n    clearTimeout(initTimer);\n    showFailure('This view could not connect to its host','ui/initialize failed: '+(e&&e.message||JSON.stringify(e)),startInit);\n  });\n}\nstartInit();\n})();\n</script></body></html>";
+export declare const GGUI_RENDER_SHELL_HTML = "<!doctype html>\n<html lang=\"en\" style=\"height:100%;background-color:var(--ggui-shell-background, var(--ggui-color-surface, #1e293b))\"><head><meta charset=\"utf-8\"><title>ggui render</title></head>\n<body style=\"margin:0;height:100%;min-height:480px;background-color:var(--ggui-shell-background, var(--ggui-color-surface, #1e293b))\"><div id=\"ggui-root\" data-ggui-shell=\"thin\" style=\"height:100%;min-height:480px\"></div>\n<script>\n(function(){'use strict';\n// MCP Apps shell. Speaks the canonical postMessage protocol from\n// @modelcontextprotocol/ext-apps:\n//   1. iframe -> host: ui/initialize\n//   2. iframe -> host: ui/notifications/initialized\n//   3. host -> iframe: ui/notifications/tool-result (per CallToolResult)\n// On tool-result, read the slice envelope from _meta (spec-canonical\n// CallToolResult _meta at the top level), set window.__GGUI_META__ to\n// the envelope, fetch runtime as blob, inject as script.\n// Runtime auto-mounts inline. No nested iframe (claudemcpcontent.com\n// CSP frame-src forbids cross-origin frames). State machine matches\n// buildSelfContainedShell so the same runtime mounts both paths.\n//\n// R5 (2026-05-26): the historic /r/<shortCode> HTTP fallback was\n// removed along with the bearer-by-obscurity model -- hosts that strip\n// _meta no longer have a recovery path here. Spec-canonical hosts\n// deliver _meta inline and are unaffected.\n//\n// Phase B (2026-05-27): the historic two-slice envelope\n// (`ai.ggui/session` + `ai.ggui/stack-item`) collapsed to ONE flat\n// `ai.ggui/render` slice. runtimeUrl now lives directly on the\n// render slice; sessionId is the canonical identity.\nvar rpcId=1,pending={};\nvar rootEl=document.getElementById('ggui-root');\nrootEl.style.cssText='display:flex;flex-direction:column;height:100%;min-height:300px;margin:0';\nvar mounted=false;\nvar lastEnvelope=null;\n// Text color pairs with the shell surface: themed var when the runtime\n// injected theme CSS, else the light-on-dark fallback matching the\n// shell's static #1e293b pre-theme surface. The old hardcoded #666 was\n// illegible on that dark fallback (#481).\nvar SHELL_FG='var(--ggui-color-onSurface,#e2e8f0)';\nfunction setOverlay(text){\n  if(mounted)return;\n  rootEl.innerHTML='<div style=\"font:13px system-ui,sans-serif;padding:24px;color:'+SHELL_FG+';opacity:.55\">'+text+'</div>';\n}\nfunction escText(s){\n  return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/\"/g,'&quot;');\n}\n// Terminal failure card (#481): plain-language summary, diagnostic\n// reachable but collapsed, Retry only when a retry can actually work.\n// Same visual vocabulary as the runtime's React error boundary so the\n// two error surfaces read as one system.\nfunction showFailure(summary,detail,retry){\n  if(mounted)return;\n  rootEl.innerHTML=''+\n    '<div style=\"display:flex;flex-direction:column;align-items:center;justify-content:center;gap:10px;padding:32px 24px;min-height:160px;font-family:system-ui,sans-serif;color:'+SHELL_FG+';text-align:center\">'+\n      '<div style=\"font-size:14px;font-weight:600\">'+escText(summary)+'</div>'+\n      '<div style=\"font-size:12px;opacity:.65;max-width:320px;line-height:1.45\">The interface could not start. The conversation is unaffected \u2014 you can also just ask for the view again.</div>'+\n      (retry?'<button id=\"ggui-shell-retry\" style=\"margin-top:2px;padding:7px 18px;border-radius:8px;border:1px solid currentColor;background:transparent;color:inherit;opacity:.75;font:500 13px system-ui,sans-serif;cursor:pointer\">Retry</button>':'')+\n      '<details style=\"margin-top:6px;max-width:340px;width:100%;text-align:left;opacity:.75\">'+\n        '<summary style=\"cursor:pointer;font-size:12px\">Details</summary>'+\n        '<pre style=\"margin:6px 0 0;font:11px/1.5 ui-monospace,Menlo,monospace;white-space:pre-wrap;word-break:break-word\">'+escText(detail)+'</pre>'+\n      '</details>'+\n    '</div>';\n  if(retry){\n    var b=document.getElementById('ggui-shell-retry');\n    if(b)b.onclick=retry;\n  }\n}\nfunction postNotification(method,params){\n  try{window.parent.postMessage({jsonrpc:'2.0',method:method,params:params||{}},'*');}catch(e){}\n}\nfunction postRpc(method,params){\n  return new Promise(function(res,rej){\n    var id=rpcId++;pending[id]={res:res,rej:rej};\n    try{window.parent.postMessage({jsonrpc:'2.0',id:id,method:method,params:params||{}},'*');}\n    catch(e){delete pending[id];rej(e);}\n  });\n}\nfunction postBootstrapFailed(reason,message){\n  // Surface every shell-layer bootstrap-failure path as a typed\n  // RendererBootFailedMessage envelope so hosts pinning the C9\n  // error pane (McpAppIframe onError, IframeErrorPane) see the\n  // failure instead of staring at the inert overlay until the test\n  // times out. Reason codes match BootstrapFailureReason.\n  try{window.parent.postMessage({type:'ggui:bootstrap-failed',reason:reason,message:message},'*');}catch(e){}\n}\nasync function mountFromMeta(envelope){\n  if(mounted)return;\n  // Slice envelope shape (Phase B): { \"ai.ggui/render\": { sessionId,\n  // appId, runtimeUrl, ... } }. runtimeUrl on the render slice is\n  // the only load-bearing field at the shell layer \u2014 it tells us\n  // which iframe-runtime bundle to fetch. Everything else is\n  // optional; the runtime decides at boot time based on the meta\n  // it reads from window.__GGUI_META__.\n  var renderSlice=envelope&&envelope['ai.ggui/render'];\n  var runtimeUrl=renderSlice&&renderSlice.runtimeUrl;\n  if(!envelope||typeof runtimeUrl!=='string'){\n    // No retry: without a valid envelope there is nothing to re-run.\n    showFailure('This view could not start','MALFORMED_BOOTSTRAP: bootstrap payload malformed (no ai.ggui/render slice with a runtimeUrl).',null);\n    postBootstrapFailed('MALFORMED_BOOTSTRAP','Bootstrap payload malformed.');\n    return;\n  }\n  lastEnvelope=envelope;\n  setOverlay('Loading UI\u2026');\n  window.__GGUI_META__=envelope;\n  // Load the runtime bundle via a direct cross-origin script tag\n  // (governed by CSP script-src) instead of fetch + Blob (governed by\n  // CSP connect-src). claude.ai's claudemcpcontent.com iframe CSP\n  // forbids cross-origin connect-src so fetch throws TypeError\n  // 'Failed to fetch', but allows cross-origin script-src when the\n  // bundle responds with the right CORS headers (the iframe-runtime\n  // mount sets them). The self-contained shell already uses this\n  // pattern; legacy postMessage shell now matches it.\n  try{\n    var s=document.createElement('script');\n    s.type='module';\n    // crossorigin=anonymous opts into CORS-mode error reporting.\n    // Without it, cross-origin script tags get a sanitized\n    // \"script error\" with no details, masking the real cause\n    // (CSP block, CORS reject, module-evaluation throw). With it,\n    // the error event surfaces the actual message in the iframe\n    // console -- the bundle ships ACAO=* so credentialed mode is\n    // unnecessary.\n    s.crossOrigin='anonymous';\n    s.src=runtimeUrl;\n    s.onload=function(){mounted=true;};\n    s.onerror=function(e){\n      var msg='Runtime bundle failed to load: '+(e&&e.message||'script error');\n      showFailure('This view could not load','BUNDLE_FETCH_FAILED: '+msg,function(){mountFromMeta(lastEnvelope);});\n      postBootstrapFailed('BUNDLE_FETCH_FAILED',msg);\n    };\n    rootEl.innerHTML='';\n    document.body.appendChild(s);\n  }catch(e){\n    var msg='Runtime bundle failed to load: '+(e&&e.message||e);\n    showFailure('This view could not load','BUNDLE_FETCH_FAILED: '+msg,function(){mountFromMeta(lastEnvelope);});\n    postBootstrapFailed('BUNDLE_FETCH_FAILED',msg);\n  }\n}\nfunction readMetaFromCallToolResult(params){\n  // MCP Apps spec (specification/2026-01-26/apps.mdx:1145-1155):\n  //   ui/notifications/tool-result\n  //   params: CallToolResult  // Standard MCP type\n  // So params IS the CallToolResult and _meta lives at the top\n  // level. Spec-compliant hosts (Claude Desktop, claude.ai\n  // Connector, Claude Code) deliver slice-envelope material here.\n  // Single slice-envelope key (Phase B: ai.ggui/render). Only the\n  // render slice's runtimeUrl is load-bearing at the shell layer;\n  // the runtime reads everything else off window.__GGUI_META__\n  // after we set it.\n  if(!params||typeof params!=='object')return null;\n  var meta=params._meta;\n  if(!meta||typeof meta!=='object')return null;\n  var renderSlice=meta['ai.ggui/render'];\n  if(!renderSlice||typeof renderSlice!=='object')return null;\n  if(typeof renderSlice.runtimeUrl!=='string')return null;\n  return meta;\n}\nwindow.addEventListener('message',function(ev){\n  var m=ev&&ev.data;\n  if(!m||m.jsonrpc!=='2.0')return;\n  if(m.id!=null&&pending[m.id]){\n    var p=pending[m.id];delete pending[m.id];\n    if(m.error)p.rej(m.error);else p.res(m.result);\n    return;\n  }\n  if(m.method==='ui/notifications/tool-result'){\n    // Spec-compliant hosts: m.params IS the CallToolResult; _meta is\n    // at the top level.\n    var specMeta=readMetaFromCallToolResult(m.params);\n    if(specMeta){mountFromMeta(specMeta);return;}\n    // Read-plane door (ggui#537). A server running the read-plane-only\n    // posture publishes only the view's IDENTITY on the result -- the\n    // ui:// locator on structuredContent.resourceUri and the spec\n    // pointer _meta.ui.resourceUri -- and no bootstrap material. The\n    // per-render resource that locator names is the self-contained\n    // shell, whose document inlines the very envelope this shell needs;\n    // ask the HOST to read it (resources/read, proxied by the host's\n    // own MCP client -- no fetch from this sandbox, so a host CSP with\n    // no connect-src to the server is not in the way). R5 (2026-05-26)\n    // removed the /r/<shortCode> HTTP fallback with the bearer-by-\n    // obscurity model; this door is the spec-canonical replacement.\n    var locator=readLocatorFromCallToolResult(m.params);\n    if(locator){mountFromLocator(locator);return;}\n  }\n});\nfunction readLocatorFromCallToolResult(params){\n  if(!params||typeof params!=='object')return null;\n  var sc=params.structuredContent, meta=params._meta, uri=null;\n  if(sc&&typeof sc==='object'&&typeof sc.resourceUri==='string')uri=sc.resourceUri;\n  else if(meta&&typeof meta==='object'&&meta.ui&&typeof meta.ui==='object'&&typeof meta.ui.resourceUri==='string')uri=meta.ui.resourceUri;\n  if(!uri||uri.indexOf('ui://ggui/render/')!==0)return null;\n  return uri;\n}\nfunction envelopeFromResourceDoc(text){\n  // The per-render self-contained shell inlines its envelope on ONE\n  // line inside its meta script tag: globalThis.__GGUI_META__ = {...};\n  // (protocol gguiShellHtml). The JSON is angle-bracket-escaped by the\n  // assembler, so the first ';' followed by the closing script tag\n  // after the marker is the terminator.\n  if(typeof text!=='string')return null;\n  var marker='globalThis.__GGUI_META__ = ';\n  var start=text.indexOf(marker);\n  if(start<0)return null;\n  start+=marker.length;\n  var end=text.indexOf(';<'+'/script>',start);\n  if(end<0)return null;\n  try{var env=JSON.parse(text.slice(start,end));}catch(e){return null;}\n  return (env&&typeof env==='object'&&env['ai.ggui/render']&&typeof env['ai.ggui/render'].runtimeUrl==='string')?env:null;\n}\nasync function mountFromLocator(uri){\n  if(mounted)return;\n  setOverlay('Resolving view\u2026');\n  var res;\n  try{res=await postRpc('resources/read',{uri:uri});}\n  catch(e){\n    var rmsg='READ_DOOR_FAILED: the host could not read '+uri+' -- '+(e&&e.message||JSON.stringify(e));\n    showFailure('This view could not be resolved',rmsg,function(){mountFromLocator(uri);});\n    postBootstrapFailed('MALFORMED_BOOTSTRAP',rmsg);\n    return;\n  }\n  var c=res&&res.contents&&res.contents[0];\n  var env=envelopeFromResourceDoc(c&&c.text);\n  if(!env){\n    var emsg='MALFORMED_BOOTSTRAP: resource '+uri+' carried no ai.ggui/render envelope with a runtimeUrl.';\n    showFailure('This view could not start',emsg,function(){mountFromLocator(uri);});\n    postBootstrapFailed('MALFORMED_BOOTSTRAP',emsg);\n    return;\n  }\n  mountFromMeta(env);\n}\n// Named so the failure card's Retry can re-run the whole handshake \u2014\n// a host that missed or rejected the first ui/initialize may answer a\n// second (observed with hosts that attach their listener late).\nfunction startInit(){\n  setOverlay('Initializing\u2026');\n  var initTimer=setTimeout(function(){\n    showFailure('This view did not hear back from its host','INIT_TIMEOUT: no response to ui/initialize within 3s.',startInit);\n  },3000);\n  postRpc('ui/initialize',{\n    appCapabilities:{},\n    appInfo:{name:'ggui-render',version:'1.0.0'},\n    protocolVersion:'2026-01-26'\n  }).then(function(){\n    clearTimeout(initTimer);\n    postNotification('ui/notifications/initialized',{});\n    // Wait for the host to send ui/notifications/tool-result carrying\n    // the slice envelope in _meta \u2014 the spec-canonical delivery channel.\n    // The ui/initialize result itself carries no slice meta (the\n    // McpUiInitializeResult schema defines no such field).\n    setOverlay('Waiting for tool result\u2026');\n  }).catch(function(e){\n    clearTimeout(initTimer);\n    showFailure('This view could not connect to its host','ui/initialize failed: '+(e&&e.message||JSON.stringify(e)),startInit);\n  });\n}\nstartInit();\n})();\n</script></body></html>";
 /**
  * CSP `script-src` source expression that authorises the inline
  * `<script>` block of {@link GGUI_RENDER_SHELL_HTML} when it executes
@@ -165,6 +165,14 @@ export interface SelfContainedShellInputs {
      * renders without re-parsing.
      */
     readonly codeHash?: string;
+    /**
+     * Strict-CSP module-variant twin of {@link codeUrl} (ggui#522 slice
+     * 2): the same bytes, server-side import-rewritten to static shim
+     * assets, directly `import()`able with no `blob:`/`data:` grants.
+     * Rides only alongside `codeUrl`/`codeB64` — a load path, never a
+     * mode discriminator.
+     */
+    readonly codeModuleUrl?: string;
     /**
      * Base64-encoded compiled component source inlined on the bootstrap
      * — the fetch-free twin of {@link codeUrl}, decoded by the
@@ -392,15 +400,39 @@ export interface GguiRenderResourceTemplateOptions {
      */
     readonly codeBaseUrl?: string;
     /**
-     * Theme preset id resolved from `ggui.json#theme`. Without this,
-     * MCP-Apps hosts (claude.ai, Claude Desktop) that fetch the resource
-     * via `resources/read` always render the runtime's baked default
-     * theme — `ggui.json#theme: 'indigo'` would only take effect on
-     * the direct-browser `/r/<shortCode>` path, not in claude.ai.
+     * Strict-CSP module-variant minter (ggui#522 slice 2) — same
+     * function dep the render handler takes; the read path re-mints the
+     * `codeModuleUrl` twin alongside its re-minted `codeUrl`.
+     */
+    readonly mintCodeModuleUrl?: (args: {
+        readonly code: string;
+        readonly hash: string;
+        readonly base: string;
+    }) => string | undefined;
+    /**
+     * Static theme preset id resolved from `ggui.json#theme` — the LAST
+     * layer of the resolution the served shell stamps. The shell resolves
+     * `themeId` / `themeMode` through {@link resolveSliceTheme}, the same
+     * function the tool-result slice uses: live `themeProvider()` beats
+     * the per-render override the agent set on the GguiSession
+     * (`ggui_render({ themeId })`) beats this static value (ggui#539 —
+     * before that, `resources/read` stamped only this static layer, so a
+     * per-render override never reached a host that mounts by read).
+     * Without any layer, MCP-Apps hosts (claude.ai, Claude Desktop) that
+     * fetch the resource via `resources/read` render the runtime's baked
+     * default theme.
      */
     readonly themeId?: string;
-    /** Theme color mode resolved from `ggui.json#theme.mode`. */
+    /** Static theme color mode resolved from `ggui.json#theme.mode` (last layer; see `themeId`). */
     readonly themeMode?: "light" | "dark";
+    /**
+     * Live theme getter — the operator's current pick (the console's
+     * "Save to ggui.json" cell), evaluated per read. FIRST layer of the
+     * resolution; identical in shape and precedence to the render
+     * handler's `themeProvider` dep, so a pick that changes the next
+     * tool-result slice changes the next `resources/read` shell too.
+     */
+    readonly themeProvider?: SliceThemeDeps["themeProvider"];
     /**
      * Per-app metadata store the resource handler reads to resolve
      * `App.publicEnv` for the bootstrap projection.

package/dist/mcp-apps-outbound.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-apps-outbound.d.ts","sourceRoot":"","sources":["../src/mcp-apps-outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAUL,KAAK,uBAAuB,EAC7B,MAAM,sCAAsC,CAAC;AAkB9C,OAAO,EAaL,KAAK,sBAAsB,EAE5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAG3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0U1C,eAAO,MAAM,sBAAsB,48UAG6B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAEtB,CAAC;AAwCvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAaxE;AAuGD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,EACjB,SAAS,GAAE,MAA+B,EAC1C,aAAa,CAAC,EAAE,MAAM;AACtB;;;;;;;;;;;GAWG;AACH,UAAU,CAAC,EAAE,MAAM;AACnB;;;;;;;;;;;;;GAaG;AACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACjD,MAAM,CAoGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAMpE;AAyCD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAuH9E;AA4HD;;;;GAIG;AACH,MAAM,WAAW,iCAAiC;IAChD;yBACqB;IACrB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC;IAClE;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,0BAA0B,EAAE,gBAAgB,CAAC;IAChF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,0BAA0B,EAAE,mBAAmB,CAAC;IACtF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,iCAAiC,GACtC,IAAI,CAm/BN;AAiGD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,IAAI,GAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CACxD,GACL;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAiBvC"}
+{"version":3,"file":"mcp-apps-outbound.d.ts","sourceRoot":"","sources":["../src/mcp-apps-outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEhB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAWL,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACpB,MAAM,sCAAsC,CAAC;AAkB9C,OAAO,EAaL,KAAK,sBAAsB,EAE5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAG3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAoY1C,eAAO,MAAM,sBAAsB,yraAG6B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAEtB,CAAC;AAwCvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAaxE;AAyGD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,EACjB,SAAS,GAAE,MAA+B,EAC1C,aAAa,CAAC,EAAE,MAAM;AACtB;;;;;;;;;;;GAWG;AACH,UAAU,CAAC,EAAE,MAAM;AACnB;;;;;;;;;;;;;GAaG;AACH,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GACjD,MAAM,CAoGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAMpE;AAyCD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG,MAAM,CAiI9E;AA4HD;;;;GAIG;AACH,MAAM,WAAW,iCAAiC;IAChD;yBACqB;IACrB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC;IAClE;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,0BAA0B,EAAE,gBAAgB,CAAC;IAChF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,0BAA0B,EAAE,mBAAmB,CAAC;IACtF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,iCAAiC,GACtC,IAAI,CAihCN;AAiGD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,IAAI,GAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;CACxD,GACL;IAAE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAiBvC"}